Privacy Policy

QuranArena is an independent Quran reading, vocabulary, memorization, and multiplayer learning application. It uses Quran Foundation (QF) APIs. QF also operates services in the Quran.com and QuranReflect ecosystem. QuranArena is not an official QF application, and does not currently import your QuranReflect reflections.

This policy covers information handled by QuranArena, based in Ontario, Canada. QF account services have their own privacy policy. For privacy questions, see Contact. QuranArena is operated by Abdullah Amin.

• Account and authentication: QF subject identifier, name, email and avatar when supplied by QF, a local player identifier, login timestamps, and access/refresh tokens connect your account and maintain your session. Your QF password is entered on QF’s hosted sign-in page, not collected by QuranArena.
• Reading: verse bookmarks and creation times let you return to saved passages. Bookmarks are read from and written to QF only when you opt into bookmark permission at sign-in; otherwise they stay in browser storage. Passage/search requests retrieve Quran text, translations, recitations, images and metadata. Public content retrieval does not import another user’s personal information.
• Training and progress: selected words or passages, flashcards, review ratings and timing, scheduling state, study preferences, memorization ratings and attempts, and game answers support review scheduling and your progress dashboard. Guest flashcards use browser storage; memorization attempts can be saved to Supabase for both signed-in users and users with a guest player identity, with local storage as a fallback. Local learning history may be uploaded when a supported account or guest player identity becomes available.
• Multiplayer and social: guest or account player identifiers, display names, avatars, room membership and presence, answers, scores, wins, friendships, requests and invitations run games and help you find other players. Guest multiplayer also creates server-side records.
• Technical information: requests necessarily expose network information such as IP address, requested URL and browser headers to the receiving server. Hosting and database services may keep operational or security logs. Their production retention settings still need confirmation.

Your dashboard uses these records to calculate attempts, accuracy, points, wins, activity streaks, flashcard review retention, Quran coverage and passages or modes that need more practice. These are personal learning statistics used to show your progress and suggest what to review. Relevant scores and results are also visible to other players during multiplayer games.

Use is limited to the features you authorize. The lawful bases relied on are providing requested services, legitimate interests in security and reliability, compliance with legal duties, and separate explicit consent where sensitive information requires it.

Saved passages and learning activity can reveal religious beliefs and deserve sensitive-data protection. QuranArena requires a separate, initially unticked opt-in before study and game features, including local-to-account migration. General acceptance of the Terms is not that consent. A versioned receipt records your choice and acceptance time, linked to your player record when available. Privacy controls let you withdraw existing consent across your verified account or guest identity and clear this browser’s learning data. Other open browsers stop at their next check; clear local site data on other devices separately.

QuranArena prohibits advertising profiles and selling, mining or repurposing QF user data. Personal content is not used to train AI models without prior, specific consent. QuranArena’s spaced-repetition scheduling uses study results to choose review times; the current app has no generative-AI chat or reflection-training integration.

QF provides identity, authorized account features and Quran content (QF privacy policy). Supabase stores player, training, game and social records; our primary database is in East US (North Virginia), United States, in the us-east-1 region (Supabase privacy policy). Vercel hosts the website and application routes (Vercel privacy policy). Our production Vercel Functions run in Washington, D.C., United States (iad1). We do not configure Vercel log drains or external logging services. Messages sent to support@quranarena.ca are forwarded to a monitored Proton Mail inbox, so Proton Mail handles that correspondence (Proton privacy policy).

Direct content requests to Quran.com, corpus.quran.com, verses.quran.foundation and files.quran.app, as well as remote avatar/audio URLs, expose connection information to those hosts. See the Content credits for source attribution.

Other players can see your display name, avatar and relevant game activity. QuranArena searches display names rather than email and uses “Player” when no non-email name is supplied. Public access to private identity fields is restricted. Avoid including private information in your public name. Friend and invitation recipients see information needed to identify you.

QuranArena does not use third-party audience analytics, advertising trackers or external error-reporting integrations. Learning statistics are processed within the application and its hosting/database services to provide progress and practice features, not to build advertising profiles. Hosting and database providers may still process operational or security logs as described above.

Necessary legal disclosures may occur where required by law. We require service providers handling personal information to protect it, and we prohibit them from misusing Quranic text or using QuranArena data contrary to Islamic content guidelines. Provider terms and applicable data-protection agreements govern their processing.

Encrypted, HTTP-only cookies hold QF login and session information. Login transactions expire after 15 minutes; app sessions have a maximum age of 14 days before a new sign-in. Signed, HTTP-only guest cookies last seven days. Privacy-choice cookies last up to one year. Browser session storage also holds a guest profile for display, but is not proof of ownership. Guest browser learning data expires after 24 hours of inactivity and is cleared when the app next checks it; closed browsers cannot be remotely erased. Reader/audio preferences may also be cleared. This release removes the old service-worker response cache and stops creating offline response copies. Normal browser and provider caching may still apply to public assets.

Use your browser’s site-data controls to clear cookies, local storage and caches on each device. This may remove unsynced progress and sign you out. It does not delete server records or QF bookmarks. Shared-device users should clear site data after use.

QuranArena encrypts QF session cookies and keeps server credentials outside client code. Its production security standard requires TLS 1.2+, provider encryption at rest, least-privilege access, access reviews, and secret rotation at least every 90 days and immediately after suspected compromise.

Under QF’s Security Rule 6.9 reference and developer security requirements, the operator begins incident response in less than 24 hours and reports suspected or actual API-related unauthorized access, breaches or exposure to developers@quran.com within 24 hours of discovery. Affected users and authorities are also notified when applicable law requires it. No system can guarantee absolute security.

Use Privacy controls to download app data, withdraw consent, disconnect QF or delete live app data. You can review your profile on the account page, remove individual bookmarks, and manage friends. Correct QF identity information through QF. Removing a synced bookmark changes it in your QF account too.

Signing out ends the app session and starts QF’s logout flow. Account deletion and revocation of a continuing authorization are separate actions. QF’s OAuth token revocation endpoint is a technical POST endpoint, not a one-click web form; never paste tokens into a URL. Privacy controls adds QF disconnection, which revokes the current connection and invalidates existing QuranArena account sessions. Other QF grants may require separate removal through QF. Bookmark permission is optional at sign-in. Live revocation verification remains pending. You may decline requested permissions during QF authorization where offered; dependent features may be unavailable.

You can send requests for access, correction, deletion, portability, restriction, objections or withdrawal of consent to support@quranarena.ca. We respond within 30 days after performing proportionate identity verification. You may also complain to your local data-protection authority.

To request deletion, use Privacy controls or email support@quranarena.ca. Do not include passwords or access tokens. Email requests require identity verification before erasure. Individual bookmark removal and flashcard reset do not erase all player, game, invitation or memorization records. Signing out or clearing your browser does not delete your account.

Deletion covers your profile, training, memorization, answers, memberships, friendships, invitations and consent receipts. Shared rooms may transfer to another player. It does not delete your main QF account or QF-hosted bookmarks. Account data is retained only while the account is active; permanent live-data deletion is completed within 30 days of a verified request and backup copies, if any, are removed within 90 days. If you delete your main QF account, QuranArena will delete associated app data when QF notifies us; until QF’s automated notification interface is available, contact us so we can verify and complete the deletion. Guest server records become inaccessible after 24 hours of inactivity and are scheduled for deletion at the next 15-minute cleanup run. Unlinked consent receipts expire after one year; withdrawn receipts are removed after 30 days. A restricted erasure ledger retains only player identifiers and deletion times for up to 90 days to prevent restoration of erased records; external deletion delivery IDs are retained for up to 90 days to handle retries.

QuranArena is intended for people aged 13 and older, subject to any higher minimum age required by applicable law. It is not directed at children under 13. Parents and guardians should supervise eligible minors’ use, particularly multiplayer and social features.

QuranArena asks guests and account users to confirm age eligibility before study and game features and blocks a declared underage user on that browser. This is a self-declaration, not verified age assurance. If we learn that a child under 13 provided personal information, we investigate and delete it. Contact support@quranarena.ca.

QuranArena is based in Ontario, Canada, and stores application records in its Supabase primary database in North Virginia, United States (us-east-1). This means those records are stored outside Canada. QF, Vercel and other providers may also process information outside your country; the primary database region does not establish where all provider processing, logs or backups occur. Where required, QuranArena relies on contractual safeguards such as Standard Contractual Clauses or an equivalent recognized transfer mechanism and complies with applicable local privacy and transfer laws.

This policy is effective October 25, 2026 and displays its last revision date above. Material changes will be announced in the app before taking effect and, where appropriate, by email. A new use requiring consent will obtain that consent first. The application requires a fresh choice when its consent version changes.

• Privacy contact and legal operator: Abdullah Amin
• Based in: Ontario, Canada
• Privacy and support email: support@quranarena.ca
• Public postal address: 142 Breton Avenue, Mississauga, Ontario L4Z 4K4, Canada

Email is the contact channel for privacy requests and support. QF’s developer incident mailbox above is for API security reports; it is not QuranArena’s customer-support or deletion inbox.